1. About this Policy

This Privacy Policy explains how MWS Care Services Inc. ("MWS," "we," "us" or "our") collects, uses,

discloses, retains and safeguards personal information in connection with our websites, MWS Connect

applications and portals, pharmacy delivery and courier services, customer support, driver and contractor

operations, and related services (collectively, the "Services").

This policy applies to patients and delivery recipients, pharmacy and healthcare partners, website visitors,

MWS Connect users, business contacts, prospective customers, drivers, contractors and job applicants.

Employee information may also be governed by internal policies and applicable employment law.

MWS may act as an organization responsible for personal information, as a service provider or processor

acting for a pharmacy or healthcare partner, or as an agent or electronic service provider under applicable

health-privacy law. The role depends on the service and contractual relationship.

2. Laws and Standards

MWS handles personal information in accordance with laws that apply to the relevant activity and location.

These may include Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA),

Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), and other Canadian privacy, anti-spam

and health-sector requirements.

For U.S. operations, applicable requirements may include the Health Insurance Portability and Accountability Act (HIPAA) and related business associate obligations where MWS performs covered functions involving protected health information, as well as state consumer privacy and consumer health-data laws. Some U.S. laws apply only when statutory thresholds or other conditions are met. MWS will honor rights required by applicable law and may voluntarily provide comparable controls where reasonably feasible.

3. Information We Collect

3.1 Delivery recipient and patient information

• Identity and contact information, such as first and last name, delivery address, unit number, telephone

number, email address and preferred language.

• Delivery and order information, such as pharmacy or healthcare provider, order or reference number,

delivery instructions, delivery window, status, route and service history.

• Health-related information that may be necessary to perform an authorized service, such as the fact that

an individual receives a pharmacy or health-related delivery, temperature-control or handling

requirements, and limited prescription or order details supplied by an authorized healthcare partner.

• Proof-of-delivery information, including timestamps, recipient or authorized-person name, signatures,

delivery photographs, attempted-delivery notes, identification-verification results where required, and

communications about delivery completion or exceptions.

• Location information, including delivery coordinates, route information, driver location during active

assignments, and location-derived timestamps used for dispatch, safety, service verification and live

tracking.

3.2 Website, MWS Connect and technical information

• Account information, login credentials in protected form, role, organization, permissions and account

activity.

• Sign-in information from third-party identity providers. If an individual chooses to create an account or

sign in using Google Sign-In (or a similar third-party identity service), MWS receives limited profile

information from that provider — such as name, email address and a profile identifier — as authorized

MWS Care Services Inc. • 3136 Mavis Road, Mississauga, ON L5C 1T9

MWS CARE SERVICES INC. | PRIVACY POLICY

by the individual and permitted by the provider. Use of a third-party sign-in option is also subject to that

provider's own privacy practices, in addition to this policy.

• Device, browser, IP address, operating system, application version, log, diagnostic, security and usage

information.

• Cookies and similar technologies used for authentication, preferences, security, performance and

analytics. Advertising cookies will be used only if disclosed and permitted by applicable consent

requirements.

• Messages, support requests, feedback and information a user enters or uploads through the Services.

3.3 Pharmacy, business, driver and workforce information

• Business contact information, contracts, service preferences, billing records and operational

communications.

• Driver, contractor, applicant and workforce information, including contact details, licence and vehicle

information, screening and training records, availability, route activity, location during work, performance,

incident and payment-administration records.

3.4 Possible future payment features

MWS does not currently collect payment-card information through the Services. If payment features are

introduced, payments may be processed by a specialized payment provider. MWS will disclose the provider

and applicable practices at or before collection. MWS generally intends not to store full payment-card

numbers or security codes.

4. How We Collect Information

We may collect information directly from individuals; from pharmacies, healthcare providers, corporate clients and their authorized systems; from drivers and contractors; automatically through websites, applications, cookies, GPS-enabled devices and security logs; and from service providers, identity or address-verification sources, and public sources where lawful and appropriate.

Where a pharmacy or healthcare partner provides patient information to MWS, that partner is responsible for having lawful authority to provide it. MWS uses that information only for authorized purposes, subject to

applicable law and contractual instructions.

5. Why We Use Information

• Create and administer accounts and authenticate users.

• Schedule, dispatch, route, track, attempt, complete and verify deliveries and pickups.

• Send delivery notices, estimated arrival times, status updates and service communications.

• Confirm identity or authorization, obtain signatures and photographs, maintain chain of custody, and

support cold-chain, controlled-substance and other special handling requirements.

• Support pharmacy partners, recipients, drivers and users; investigate missing, delayed, damaged,

misdirected or disputed deliveries; and resolve complaints.

• Operate, secure, test, maintain and improve MWS Connect and the Services, including analytics, quality

assurance, fraud prevention, audit logging and service planning.

• Train and manage drivers, contractors and workforce members, allocate capacity, administer

compensation and meet safety and compliance obligations.

• Invoice business clients, maintain records, enforce agreements, establish or defend legal claims, and

complete corporate transactions.

MWS Care Services Inc. • 3136 Mavis Road, Mississauga, ON L5C 1T9

MWS CARE SERVICES INC. | PRIVACY POLICY

• Meet legal, regulatory, public-health, law-enforcement, insurance and reporting obligations, and protect

individuals, the public, MWS and our partners.

• Send marketing or business-development communications where permitted. Individuals may unsubscribe from electronic marketing at any time; service and transactional messages may continue.

6. Consent and Other Lawful Authority

MWS obtains consent where required and relies on other lawful authority where permitted, including

processing necessary to provide a requested or authorized service, perform a contract, comply with law,

protect safety, prevent fraud, or act on documented instructions from a pharmacy or healthcare partner.

Because health and precise location information can be sensitive, MWS uses express consent or another

clearly applicable legal authority when required.

Consent may be withdrawn, subject to legal or contractual restrictions and reasonable notice. Withdrawal

may limit our ability to provide a Service. To withdraw consent, contact us using Section 17.

7. How We Share Information

MWS does not sell personal information or consumer health data. We may disclose or make information

available only as reasonably necessary to:

• The pharmacy, healthcare provider, corporate client or other organization that requested or authorized

the service.

• The delivery recipient, authorized representative, caregiver or person designated to receive an item,

subject to identity and authorization controls.

• Drivers, contractors, dispatchers and workforce members who need the information to perform an

assigned function.

• Technology, hosting, mapping, routing, messaging, authentication, customer-support, security, analytics,

document-storage, professional-advisory and other service providers operating under contractual and

confidentiality restrictions (including identity providers used for sign-in, such as Google).

• Insurers, auditors, legal advisers, regulators, courts, law enforcement or public authorities where required

or permitted by law.

• A purchaser, investor or successor in a proposed or completed merger, financing, reorganization or sale,

subject to appropriate confidentiality and legal safeguards.

MWS requires service providers to use information only for authorized purposes and to maintain  safeguards appropriate to the sensitivity of the information. MWS does not permit third parties to use patient or delivery information for their own advertising.

8. Health Information and Pharmacy Deliveries

MWS limits access to personal health information to what is reasonably necessary for the authorized service. Drivers and personnel are expected to follow confidentiality, identity-verification, secure-handling,

chain-of-custody and incident-reporting requirements. Delivery photographs should confirm the delivery and should avoid capturing people, medication labels, household interiors or unrelated personal information unless necessary and authorized.

In Ontario, where MWS acts for a health information custodian, MWS will comply with the custodian’s lawful

instructions and applicable PHIPA duties. In the United States, MWS may in some circumstances act as a

courier conduit; in others, MWS Connect or related services may make MWS a HIPAA business associate.

Where a business associate agreement is required, that agreement governs permitted uses, safeguards,

incident reporting and subcontractors in addition to this policy.

MWS Care Services Inc. • 3136 Mavis Road, Mississauga, ON L5C 1T9

MWS CARE SERVICES INC. | PRIVACY POLICY

9. Location, Tracking and Delivery Evidence

Location information is used for dispatch, route optimization, estimated arrival times, driver and public safety, service verification, investigation and operational reporting. Driver location should be collected only while on duty, using an active work function, or as otherwise disclosed and permitted. Live tracking shared with recipients should be limited to the information and time reasonably necessary for the delivery.

Signatures, photographs and timestamps are collected to verify delivery, document authorization or

exceptions, resolve disputes and meet pharmacy or legal requirements. MWS will not use facial recognition

or biometric identification unless separately disclosed and lawfully authorized.

10. Cookies and Analytics

The website and MWS Connect may use essential cookies and similar technologies for login, security,

session management and preferences. We may also use performance or analytics technologies to

understand use and improve reliability. Where required, non-essential technologies will not be activated until consent is obtained. Browser controls may block cookies, but some functions may not work correctly.

11. Retention and Disposal

MWS retains personal information only as long as reasonably necessary for the purposes described in this

policy, contractual requirements, pharmacy instructions, safety, audit, insurance, dispute resolution and

applicable law. Retention periods vary by record type and sensitivity. When information is no longer required,

MWS securely deletes, destroys or de-identifies it, subject to backup cycles and legal holds.

MWS will maintain and review a documented retention schedule. Health information, delivery evidence,

precise location logs and identification records should receive shorter or specifically justified retention periods rather than indefinite retention.

12. Safeguards

MWS uses administrative, technical and physical safeguards proportionate to the sensitivity and volume of

information. Measures may include role-based access, least-privilege permissions, multi-factor authentication where appropriate, encryption in transit and at rest where supported, secure devices, confidentiality agreements, workforce training, vendor assessment, logging and monitoring, backups, secure disposal, incident response and periodic risk review.

No system is completely secure. Users must protect account credentials, use only authorized devices and

promptly report suspected unauthorized access or loss.

13. International and Cross-Border Processing

MWS and its service providers may process information in Canada, the United States or other jurisdictions.

Information processed outside an individual’s province, state or country may be subject to the laws and

lawful access authorities of that jurisdiction. MWS remains accountable for personal information transferred to service providers for processing and uses contractual or other measures intended to provide a comparable level of protection, as required by applicable law.

14. Privacy Incidents

MWS maintains procedures to identify, contain, investigate, document and remediate suspected privacy or

security incidents. MWS will notify affected individuals, healthcare partners, regulators or others when required by law or contract. Individuals should promptly report a lost device, misdirected delivery, exposed

label, unauthorized account access or other suspected incident using Section 17.

MWS Care Services Inc. • 3136 Mavis Road, Mississauga, ON L5C 1T9

MWS CARE SERVICES INC. | PRIVACY POLICY

15. Individual Privacy Rights

Depending on location and applicable law, an individual may have rights to request access to personal

information, correct inaccuracies, withdraw consent, request deletion, obtain a portable copy, limit or object to certain processing, opt out of targeted advertising, sale or profiling, or appeal a denied request. Some rights are subject to exceptions, identity verification, record-retention duties and the rights of others.

For information controlled by a pharmacy or healthcare provider, MWS may direct the request to that

organization or assist it in responding. MWS will not discriminate against an individual for exercising an

applicable privacy right.

15.1 Canada and Ontario

Individuals may request access to and correction of personal information held by MWS and may challenge

compliance with this policy. Requests concerning a pharmacy’s patient record should normally be submitted

to the pharmacy or healthcare custodian. Complaints may also be made to the Office of the Privacy

Commissioner of Canada or the Information and Privacy Commissioner of Ontario, as applicable.

15.2 United States and Virginia

Where an applicable U.S. state privacy law provides rights, MWS will provide the required request and

appeal process. For Virginia residents, rights under the Virginia Consumer Data Protection Act apply only

when MWS and the processing are within the Act’s scope and not exempt. If applicable, a verified consumer

may request access, correction, deletion, portability, or opt out of targeted advertising, sale or certain

profiling, and may appeal a denial by replying to the decision or using the privacy contact below.

15.3 California and other states

If MWS becomes subject to the California Consumer Privacy Act or another state privacy law, MWS will

provide any required supplemental notice, notice at collection, request methods and opt-out mechanism.

MWS does not currently sell or share personal information for cross-context behavioral advertising. If that

practice changes, MWS will update this policy and provide any legally required choice before the change

applies.

16. Children’s Information

The Services are intended for pharmacies, healthcare organizations, adult delivery recipients, drivers and

authorized business users, and are not directed to children. MWS may receive limited information about a

minor when needed for an authorized healthcare delivery. In that situation, MWS relies on the pharmacy,

healthcare provider, parent, guardian or other lawful authority and uses the information only for the

authorized service. MWS does not knowingly use children’s information for targeted advertising.

17. Contact MWS or Make a Request

Privacy Officer

MWS Care Services Inc.

3136 Mavis Road

Mississauga, Ontario L5C 1T9

Canada

Email: contact@mwscares.com

MWS Care Services Inc. • 3136 Mavis Road, Mississauga, ON L5C 1T9

MWS CARE SERVICES INC. | PRIVACY POLICY

Please describe the request, identify the relevant service or account, and provide enough information for

MWS to verify identity and locate the record. Do not send prescription details, government identification or

other sensitive information by ordinary email unless MWS requests it through a secure method.

18. Changes to this Policy

MWS may update this policy to reflect changes in the Services, technology, law or business practices. The

revised policy will show a new effective date and will be posted on the website and, where appropriate, in

MWS Connect. If a change is material, MWS will provide additional notice or obtain consent where required

before the change applies.

19. Interpretation

This policy is intended to provide transparency and does not reduce rights or obligations imposed by

applicable law, a pharmacy’s privacy notice, a data-processing agreement, a business associate agreement

or another binding contract. If there is a conflict, the applicable law or binding agreement controls to the

extent of the conflict.